A stranger calls and says they are from Coinbase security. They might know you use the exchange, or refer to an account detail. That can feel convincing, but it is not proof of who is calling.
The concern has fresh context. On October 27, 2026, Coinbase said contact information belonging to a small subset of its customers was affected by an incident at analytics provider Amplitude. Amplitude publicly described the incident on October 28. Coinbase says its own systems were not accessed without authorization and customer funds were not affected. No credible report reviewed for this article establishes that criminals have used this specific exposure to make scam calls.
What happened at Amplitude, and when?
Amplitude says it detected, contained and remediated unauthorized access to a localized portion of its internal systems on September 28. Its October 28 customer update says event data relating to fewer than 0.3% of its customer accounts was affected. That percentage refers to Amplitude customers, not to the number of Coinbase users exposed.
Coinbase's own public response appeared on October 27, followed by further reporting on October 28. Coinbase described a small subset of affected customer contact data and said it was contacting affected customers and regulators. The exact number of Coinbase users and the individual records involved have not been publicly established.
Contact and limited transaction data, not account access
In comments reported by Unchained and Cointelegraph, a Coinbase spokesperson said the information involved contact data and limited transaction data. The spokesperson said home addresses and information that would directly allow access to customer accounts or funds were not involved.
Coinbase specifically disputed an online claim that more than 70,000 Coinbase accounts were affected. Neither a verified Coinbase-user count nor individual fraud losses were supplied. Do not confuse this incident with Coinbase's separate 2025 insider-data case.
The distinction matters: data exposure is a security concern, but it does not by itself establish a stolen password, stolen cryptocurrency, unauthorized login or a phishing campaign connected to this event.
Sources: Unchained · Cointelegraph
Why a fake support call could sound convincing
A scammer who knows which service someone uses can tailor a message: a supposed account lock, fraud review or security check. Knowledge of an email address or other customer detail can make the conversation feel personal. That is a general impersonation risk, not evidence that a particular caller obtained data from Amplitude.
Coinbase already warns that fraudsters impersonate its support staff, sometimes spoofing a familiar-looking caller ID. They may ask people to transfer funds, give up one-time login codes, install remote-access software or contact a support number supplied in a message.
One clear rule from Coinbase's published guidance is:
“Coinbase will never ask you to contact an unknown number to reach us.”
Sources: Coinbase Help · Unchained
Four red flags in an unexpected Coinbase call or text
A genuine-looking incoming number does not authenticate the speaker. Caller ID can be spoofed. Do not assume a convincing detail proves that this new vendor incident caused a particular phone call.
- Someone tells you that a data incident requires an immediate transfer of crypto to a new wallet or vault.
- A caller asks for your password, recovery phrase, or one-time account verification code.
- A message supplies a callback number or link and insists you use that route rather than your own Coinbase app.
- The person wants you to install screen-sharing software or gives instructions to let them control your device.
Sources: Coinbase Help
How to verify and protect your account
Leave the conversation.
Do not share codes, accept a support transfer, click an unknown link or move assets on a caller's instructions.
Open Coinbase independently.
Use the app you already have or type the company's real website yourself; find support through the official Help Center.
Review account security.
Check for unfamiliar sign-ins or transactions, enable strong two-factor authentication and consider Coinbase's withdrawal allow-listing feature.
If necessary, lock the account.
Coinbase's official guidance explains how to lock your account in-app and contact its security team.
Sources: Coinbase Help
If you already shared something with a supposed agent
If you revealed a password or one-time code, immediately sign in through the real service, secure your account and contact Coinbase's official support. If you installed remote-access software, disconnect the device from the network, remove the software with trusted help and secure accounts from a separate device.
If you transferred crypto, immediately contact Coinbase and the receiving service if known, preserve transaction records and report the incident to the FBI at IC3.gov and to ReportFraud.ftc.gov. Cryptocurrency transfers may be irreversible; recovery is not assured.
PhoneYa can show community reports about suspicious phone numbers, but a lookup cannot establish who called. A number displayed during a scam could belong to an unrelated person or company.
Sources: Coinbase Help · Federal Trade Commission
Sources & further reading
- AmplitudeCustomer Update - Recent Security Incident | October 28, 2026
- CoinDeskCoinbase says user funds are safe after vendor exposes customer data | published October 27, 2026; updated October 27
- UnchainedCoinbase Says Amplitude Incident Hit Contact and Some Transaction Data, Denies 70K Claim | October 28, 2026
- CointelegraphCoinbase denies systems breach, says vendor exposed customer data | October 28, updated October 29, 2026
- Coinbase HelpTechnical support and impersonation scams | guidance accessed October 29, 2026
- Federal Trade CommissionWhat To Do if You Were Scammed | June 2026
By PhoneYa Editorial, based on the sources above.